ManoMano Says Third-Party Breach Exposed Data of 38 Million People
Summary
ManoMano says unauthorized access through a third-party customer service provider led to personal data being extracted for about 38 million people. It says passwords were not accessed and it revoked the provider’s access.
Key points
- ManoMano says it identified unauthorized access linked to a third-party customer service provider in January 2026.
- The company’s investigation found about 38 million individuals affected; exposed data varies and may include names, email addresses, phone numbers, and customer service communications.
- A person using the alias “Indra” separately claimed to hold 37.8 million accounts, support tickets, and attachments.
- ManoMano says account passwords were not accessed and no data modifications occurred on its own systems.
- The company revoked the subcontractor’s access, strengthened access controls and monitoring, and notified CNIL and ANSSI.
- Customers were advised to watch for phishing, verify communications, monitor bank accounts, and avoid suspicious links and attachments; the investigation is ongoing.
Article Details
- Victim Organization
- ManoMano
- Incident Type
- Data breach involving unauthorized extraction of customer data after a third-party customer service provider was compromised.
- Incident Date
- 2026-01-01
- Data Types Exposed
- Full names
- Email addresses
- Phone numbers
- Customer service communications
- Affected Records
- Approximately 38 million individuals, according to ManoMano's investigation. An individual using the alias “Indra” separately claimed to hold data on 37.8 million user accounts.
- Operational Impact
- ManoMano said no account passwords were accessed and no data modifications occurred on its systems. It disabled the relevant access, revoked the subcontractor's access to customer data, strengthened access controls and monitoring, notified authorities, and informed affected customers.
- Ransom Or Extortion
- No ransom demand is reported. An individual using the alias “Indra” claimed to hold user account details, support tickets, and attachments.
- Claim Status
- confirmed